package cn.tedu._08security.controller;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api/")
public class UserController {
    @GetMapping("public/hello")
    public String helloPublic(){
        return "public!!!";
    }

    /**
     * PreAuthorize:
     *   1.指定拥有 sys:private:view 权限的用户,才能正常访问该资源
     *   2.先认证[输入用户名和密码],再鉴权[检查用户的权限]
     */
    @PreAuthorize("hasAuthority('sys:private:view')")
    @GetMapping("private/hello")
    public String helloPrivate(){
        return "private!!!";
    }
}
